Privacy Policy

Comix turns one photograph into a personalised comic. That photograph is the most sensitive thing you will ever give us, and it is treated accordingly.

The rest of this page is the detail behind those promises: exactly what we hold, on what legal basis, for how long, and who else touches it — including the advertising measurement we use on our marketing, sign-up and checkout pages.

Comix is operated by Artemius Labs LLC, 1021 E Lincolnway #10375, Cheyenne, WY 82001, United States. Artemius Labs LLC is the data controller for the personal data described here. Write to support@mycomicstory.com for any privacy question, request, or complaint. We answer within thirty (30) days, and sooner where the law requires it.

This policy covers mycomicstory.com and the Comix web application. It does not cover third-party sites you reach from a link we publish.

Account data

Email address, display name, password hash, and — if you sign in with Google — the Google account identifier, email, and name released by that sign-in.

Child and book data

The photograph you upload (downscaled on your device to at most 420 pixels before it is sent), the child's first name or nickname, the child's age as you select it, optional interests, the chosen occasion or your own story idea (up to 280 characters), the comic style, the generated story text and illustrations, any edits you make, whether a share link is switched on, and the time you confirmed parental consent.

Subscription data

Plan, billing interval, subscription status, and renewal dates. Card details are handled by Stripe and never reach our servers.

Order data

For printed keepsakes: recipient name, shipping address, format, quantity, gift note, and order status.

Technical data

IP address, device and browser type, timestamps, pages viewed, and generation events — used for security, rate limiting, abuse prevention, and diagnosing failures.

Advertising data

Meta cookies set by the Meta Pixel on our marketing, sign-up and checkout pages, and the event data we send to Meta described in section 8.

Support data

The content of emails and messages you send us, and our replies.

We use Meta advertising measurement as set out in section 8. We do not sell personal data, and we do not buy personal data from brokers.

A book is about a child, so a book contains a child’s personal data — a facial image, a first name, an age, and any interests you choose to add. We treat this as the most protected category we hold.

• Comix is used by parents and guardians. Accounts are for adults aged 18 or over, and children do not create accounts.
• Before a child’s photo can be used, the person uploading it must tick a box confirming they are the child’s parent or legal guardian, or have the parent or guardian’s permission, and agreeing to the photo being used to create the comic. We store the time of that confirmation with the book.
• The photograph is processed to generate the artwork for your book and for nothing else — no facial-recognition database, no biometric identity matching, no advertising, no training. Photos, children’s names and comic content are never sent to Meta.
• Books are private by default: only you, signed in to your account, can open them. On the Family plan and above you can create a share link. Anyone with that link can read the finished comic — but never the original photo, the child’s age, or their interests — and turning the link off stops it working immediately.
• Children cannot register, and we do not knowingly collect data directly from a child.
• If we learn that a child created an account, or that a photograph was uploaded without guardian consent, we delete the account and its content promptly.

A guardian may ask us at support@mycomicstory.com what we hold about their child and require its deletion, whether or not they hold the account it sits under.

To provide the Service

Generating, storing, editing, previewing, downloading, and — when you turn on a share link — sharing your books. Basis: performance of our contract with you.

To process a photograph

Creating an illustrated likeness from the image you upload. Basis: your explicit consent, given when you tick the consent box at upload and withdrawable at any time by deleting the book, together with performance of our contract with you.

To take payment

Subscriptions, renewals, print orders, and fraud checks. Basis: contract, and our legal obligations on tax and accounting.

To keep the Service safe

Automated moderation of free-text inputs, rate limiting, bot protection on sign-up, abuse detection, and incident investigation. Basis: our legitimate interest in a service that is not misused, and the protection of children.

To measure our advertising

Measuring and optimising our ads on Meta with the Meta Pixel and Conversions API, as described in section 8. Basis: our legitimate interest in knowing which ads work. You can object at any time.

To support and inform you

Answering messages and sending service notices such as billing notices and policy changes. Basis: contract and legitimate interest.

To comply with law

Retaining records, answering lawful requests, and reporting illegal material. Basis: legal obligation.

Marketing email, if we ever send it, is opt-in and separately unsubscribable. Service and billing notices are not marketing and cannot be switched off while you hold an account.

To write and illustrate a comic we send OpenAI, acting as our service provider, only the inputs it needs: the photograph, the child’s first name, their age, any interests you add, and the chosen occasion or your own story idea (up to 280 characters). We also send the finished illustrations back to a vision model, which checks where the characters stand so that speech balloons do not cover faces.

• OpenAI processes this data to fulfil our requests. The photograph is sent solely so the illustrations can be drawn.
• Your inputs and outputs are not used to train models. Under OpenAI’s API data policy, data sent through its API is not used to train its models, and we never use your photos to train models either.
• Providers may hold transient copies for a short abuse-monitoring window, after which they are deleted on their side.
• Free-text inputs are length-limited and checked by OpenAI’s automated moderation before a story is written. Requests flagged as unsafe are refused. Moderation is automated; there is no human review of your content.
• Generation is automated, but it produces a book, not a decision about you. No processing we carry out has a legal or similarly significant effect on you.

Stories are written under rules that require gentle, age-appropriate content, but AI output can occasionally be imperfect. You can delete a book at any time or, on the Family plan and above, edit any page, and you can report a problem to support@mycomicstory.com. If a request you believe was legitimate is refused by moderation, try rewording it or write to us at the same address.

We share personal data only with providers who need it to run the Service, and only for that purpose:

Supabase

Database, authentication, and file storage — accounts, books, photographs, illustrations, and orders.

Vercel

Hosting and delivery of the website and web application.

OpenAI

Writing the story, drawing the illustrations, and automated moderation of free-text inputs.

Stripe

Payments, subscriptions, and the billing portal. Card details go straight to Stripe and never reach our servers.

Google

Optional “Sign in with Google”, only if you choose to use it.

Cloudflare

Turnstile bot protection on the sign-up form.

Meta Platforms

Advertising measurement through the Meta Pixel and Conversions API, as described in section 8.

Print and delivery

Print partners and carriers, which receive the book file and the shipping address for an order you place.

We also disclose data where we must: to comply with a valid legal request, to enforce our Terms, to protect the rights and safety of a child or any person, or as part of a merger or acquisition — in which case we will tell you before your data becomes subject to a different policy.

We do not sell personal data.

We advertise Comix on Meta’s platforms and use two Meta tools to measure and optimise those ads:

Meta Pixel

Runs on our marketing, sign-up, and checkout pages — never on comic or book pages — and sets Meta cookies such as _fbp and _fbc.

Meta Conversions API

From our servers we send Meta a SHA-256 hash of your email address, your account ID, your IP address, your browser user agent, and the name of the event, such as sign-up, checkout started, or purchase.

Never sent to Meta

Photos, children's names, and comic content.

You can limit or stop this:

• block or clear Meta cookies in your browser’s cookie settings;
• use an ad blocker or tracking blocker;
• adjust your ad settings with Meta at facebook.com/adpreferences;
• write to support@mycomicstory.com to object to this processing.

Artemius Labs LLC is based in the United States and our providers operate globally, so your data is processed in the United States and may be processed outside your country. Where data leaves the European Economic Area or the United Kingdom, we rely on adequacy decisions or on Standard Contractual Clauses together with the additional safeguards those clauses require. Write to support@mycomicstory.com for details of the mechanism used for a particular provider.

Books, photographs, illustrations, story text

Until you delete the book or your account. Deletion is permanent and immediate.

Deleted items in backups

Copies can remain in our providers' encrypted backups for up to thirty (30) days before they are purged.

Account and profile

Until you delete your account in Settings, when it is deleted immediately (subject to the backup period above).

Print order records

Kept while your account exists, so we can fulfil and support the order, and deleted with your account.

Payment and invoice records

Held by Stripe for the periods tax and accounting law require; deleting your Comix account does not remove them.

Technical and security logs

Up to twelve (12) months, then deleted or aggregated beyond identification.

Support correspondence

Twenty-four (24) months from the last message.

Where we must keep a record for legal reasons, we keep the minimum needed and stop using it for anything else.

• The child’s photo is downscaled on your device to at most 420 pixels before upload, so we never receive a full-resolution original.
• Encryption in transit (HTTPS), and encryption at rest provided by our hosting providers.
• Illustrations are kept in private storage and delivered to your browser only through signed links that expire after one hour.
• Database row-level security, so a signed-in account can reach its own books and nothing else. Books are private by default, and share links use a secret random token that you can switch off.
• Rate limits on sign-up, story generation, drawing, and PDF downloads, and bot protection on sign-up.
• Security headers, including a Content-Security-Policy.
• Passwords are stored only as salted hashes by our authentication provider; we never see your password.

No system is perfectly secure. If a breach affects your personal data and presents a risk to you, we will notify you and the competent supervisory authority within the deadlines the law sets — for the GDPR, seventy-two (72) hours from becoming aware of it.

Depending on where you live, you have the right to:

• access the personal data we hold about you and your child;
• correct anything inaccurate;
• delete your data — including every photograph and every book;
• receive a copy of your data in a portable format;
• object to, or ask us to restrict, processing based on legitimate interests, including advertising measurement;
• withdraw consent to photo processing at any time, without affecting past processing;
• complain to your data protection authority.

Much of this is self-service: download any book as a PDF, delete any book from your library, turn off a share link, or use Settings → Delete my account and all photos to permanently delete your account, every book, photo and illustration, the print order records we hold, and your profile. There is no one-click export of a whole account — for access to, or a copy of, everything we hold, write to support@mycomicstory.com.

1. 1Send your request from the email address on the account, or tell us how else to reach you.
2. 2We verify that the request really comes from the account holder or the child's guardian — a proportionate check, never a demand for identity documents unless the request itself makes that necessary.
3. 3We answer within thirty (30) days, and tell you if a complex request needs longer.

We keep this deliberately small:

Essential

Session and authentication cookies that keep you signed in and protect against request forgery. These cannot be switched off while you use the Service.

Preferences

Local storage for things like your last chosen style or draft edits, so a reload does not lose your work.

Analytics

Minimal, aggregated usage counts to see which parts of the flow break.

Advertising

Meta Pixel cookies such as _fbp and _fbc, set on our marketing, sign-up, and checkout pages only — never on comic or book pages — to measure and optimise our ads. See section 8.

You can clear cookies and local storage in your browser; doing so signs you out. To limit advertising cookies, block them in your browser settings, use an ad blocker, or adjust your settings at facebook.com/adpreferences — section 8 has the details.

EEA and UK. The legal bases are listed in section 5. You may complain to your national supervisory authority, or to the Information Commissioner’s Office in the UK.

California. You may request the categories and specific pieces of personal information we collected, request deletion, and request correction. We do not sell personal information. Our use of Meta advertising measurement (section 8) may count as “sharing” for cross-context behavioural advertising under the CCPA/CPRA; you can opt out by writing to support@mycomicstory.com and by using the controls described in section 8. We do not discriminate against anyone who exercises a right.

United States — children. Comix is directed at parents and guardians, not at children, and children do not create accounts. Where a book contains a child’s data, it is uploaded and controlled by the adult who holds the account, who may review and delete it at any time.

We update this policy as the Service changes. The version line at the end of this page always identifies the current version, and material changes are announced by email or in-app at least thirty (30) days before they take effect. Continued use after that date is acceptance of the updated policy.